Upgrade to PRO for Only $50/Year—Limited-Time Offer! 🔥

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
0
45

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022
Tweet

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
150
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
130
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
81
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
130
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
92
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
0
76
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
なぜ使われないのか？──定量×定性で見極める本当のボトルネック
Avatar for KAKEHASHI kakehashi
PRO
1
760
Active Directory 勉強会 第 6 回目 Active Directory セキュリティについて学ぶ回
Avatar for Eureka eurekaberry
16
5.9k
Agents IA : la nouvelle frontière des LLMs (Tech.Rocks Summit 2025)
Avatar for Guillaume Laforge glaforge
0
370
“決まらない”NSM設計への処方箋 〜ビットキーにおける現実的な指標デザイン事例〜 / A Prescription for "Stuck" NSM Design: Bitkey’s Practical Case Study
Avatar for 株式会社ビットキー / Bitkey Inc. bitkey
PRO
1
340
Microsoft Agent 365 を 30 分でなんとなく理解する
Avatar for skmkzyk skmkzyk
1
290
pmconf2025 - 他社事例を"自社仕様化"する技術_iRAFT法
Avatar for yamachi｜@yamapiya_ daichi_yamashita
0
490
HIG学習用スライド
Avatar for 野瀬田　裕樹 yuukiw00w
0
110
Introduction to Bill One Development Engineer
Avatar for Sansan, Inc. sansan33
PRO
0
330
A Compass of Thought: Guiding the Future of Test Automation ( #jassttokai25 , #jassttokai )
Avatar for teyamagu teyamagu
PRO
1
190
mablでリグレッションテストをデイリー実行するまで #mablExperience
Avatar for 弁護士ドットコム bengo4com
0
470
Contract One Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
0
9.9k
ML PM Talk #1 - ML PMの分類に関する考察
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
1
490

Featured

See All Featured
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
Avatar for Kevin Liebholz kevinliebholz
36
6.2k
Site-Speed That Sticks
Avatar for Harry Roberts csswizardry
13
990
KATA
Avatar for Megan Lloyd mclloyd
PRO
32
15k
Bash Introduction
Avatar for André Augusto Costa Santos 62gerente
615
210k
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
Avatar for Stéphanie Walter stephaniewalter
285
14k
Done Done
Avatar for chrislema chrislema
186
16k
Product Roadmaps are Hard
Avatar for C. Todd Lombardo iamctodd
PRO
55
12k
The Power of CSS Pseudo Elements
Avatar for Geoffrey Crofte geoffreycrofte
80
6.1k
Speed Design
Avatar for Sergey Chernyshev sergeychernyshev
33
1.4k
Distributed Sagas: A Protocol for Coordinating Microservices
Avatar for Caitie McCaffrey caitiem20
333
22k
What’s in a name? Adding method to the madness
Avatar for Product Marketing Alliance productmarketing
PRO
24
3.8k
Large-scale JavaScript Application Architecture
Avatar for Addy Osmani addyosmani
514
110k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and